Short answer: validate gateway tokens with public JWKS keys, keep a bounded refresh path for rotation, and fail closed for signup traffic when key retrieval cannot be trusted. Treat CAPTCHA verification as a separate, auditable state transition rather than a reason to weaken token checks. In an e-commerce gateway, a bot can hit the registration endpoint long before a human sees the CAPTCHA widget. The gateway therefore has two jobs: prove who signed the token, then decide whether that request...